CVE-2026-49468-LiteLLM-Auth-Bypass

CVE-2026-49468 — LiteLLM 호스트 헤더 경로 혼동을 통한 인증되지 않은 인증 우회 BerriAI의 LiteLLM 프록시에서 사전 인증 인증/권한 부여 우회. 조작된 Host 헤더 하나만으로 프록시가 공개 상태 경로health route에 대해 인증 결정을 평가하도록 만드는 반면, FastAPI는 여전히 보호된 관리 핸들러를 실행하여 API 키 없이 요청을 처리합니다...

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side...

CVE-2026-62985: Uncaught Exception

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000547 advisory. Use After Free in GitHub repository vim/vim prior to 8.2. Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note...

SUSE CVE-2026-15801

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host...

CVE-2022-30190

CVE-2022-30190 使い方 Windowsのみ docxファイルを作成: $ PoC.py docx your-host-ip サーバーを直接実行: $ PoC.py host...

Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a secon...

CVE-2025-26465

CVE-2025-26465 OpenSSHクライアントは、バージョン6.8p1から9.9p1（両端を含む）の間に論理エラーが存在し、VerifyHostKeyDNSオプションが有効な場合にアクティブな中間者攻撃（MitM）に対して脆弱になります。これにより、悪意のある第三者がクライアントの接続試行時に正規のサーバーになりすますことが可能になります。 この検出方法はどのように機能しますか？ このテンプレートは、以下の脆弱性のあるバージョンにマッチします： root@kitploit: - "SSH-2.0-OpenSSH6.8p1" - "SSH-2.0-OpenSSH6.9p1" -...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — GraalVM INLINE 평가기를 통한 Conductor 인증되지 않은 RCE Conductor OSS / Orkes3.21.21 … 3.30.2 미만은 사용자가 제공한 JavaScript를 INLINE 및 LAMBDA / DOWHILE / SWITCH 태스크에서 GraalVM 컨텍스트로 평가하며, 전체 호스트 접근 HostAccess.ALL이 활성화되어 있습니다. 스크립트는 java.lang.Runtime까지 리플렉션하여 OS 명령을 실행합니다. 커뮤니티 API에는 기본적으로 인증이 없으므로 ...

CVE-2026-73550

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

EUVD-2026-84111

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

CVE-2026-73550

Envoy (open-source edge/service proxy) is vulnerable to an HTTP/2 memory-exhaustion flaw. When a duplicate Host header is present alongside :authority , Envoy copies the decoded value before discarding it, but the discarded copy bypasses saveHeader and is not charged against request-header size o...

CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume

CVE-2026-5555 – /proc/self/fd シンボリックリンクによるコンテナエスケープ 概要 rshared 伝播でマウントされた共有ボリュームにより、悪意のあるコンテナが /proc/self/fd を介してホストファイルを指すシンボリックリンクを作成できます。ボリュームに書き込むホストプロセスがそのシンボリックリンクを辿ることで、重要なホストファイルが上書きされ、コンテナからのエスケープが発生します。 脆弱性の詳細 種類: コンテナエスケープ / シンボリックリンク攻撃 影響: ホストファイルの上書き、ホスト上での root への権限昇格。 根本原因:...

CVE-2026-91167

Warpgate , an open-source SSH/HTTPS/MySQL bastion host for Linux, has a missing authorization check in the PUT /@warpgate/admin/api/users/:id/roles/:role_id endpoint. The handler api_update_user_role in warpgate-admin/src/api/users.rs routes through AdminContext but does not require AdminPermissi...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...